Elasticsearch query with multiple fields (typo in documentation)

[saqibarfeen]

Expected Behavior

Logstash with Syslog Filter

This Logstash example is based on the configuration examples of the Logstash documentation.

[Logstash]
instance = "Elasticsearch"
index = "logstash-*"
filter = "syslog_hostname={host.name}&type=syslog"
fields = "syslog_timestamp, syslog_program, syslog_message"

Current Behavior

Logstash with Syslog Filter

This Logstash example is based on the configuration examples of the Logstash documentation.

[Logstash]
instance = "Elasticsearch"
index = "logstash-*"
filter = "syslog_hostname={host.name} AND type=syslog"
fields = "syslog_timestamp, syslog_program, syslog_message"

Possible Solution

As shown above, the multi-field query should be written with "&" and not "AND", in icinga.

Context

Your Environment

• Module version (System - About):
• Icinga Web 2 version: r2.8.1-1 and module (icinga-module-elasticsearch)
• Operating System and version: Ubuntu 16.04

[lippserd]

Hi,

Thanks for the report. Yeah, the examples are outdated. We'll fix this asap.

Cheers, Eric